> That is a hardcoded check, not a constraint. See > mls_context_isvalid() in mls.c. Constraints are just for the MLS > relationships between two different contexts, not for an > intra-context validity test. Got it. Thanks all for the response. Hardcoded definitely makes the invariant stronger. Frank